In August 2025, a divided panel of the Sixth Circuit denied an industry petition for review of a 2024 FCC rule imposing reporting requirements on telecommunications in the event of data breaches involving customers’ personally identifiable information. The industry had raised both arguments about the FCC’s statutory authority, and a 2017 Congressional Review Act disapproval. All three judges on the panel agreed with the challengers that the provision of the Telecommunication Act relating to “the confidentiality of proprietary information” did not provide statutory authority, but the majority held that the rule was within the FCC’s authority to prohibit “unjust or unreasonable” practices, and rejected the CRA challenge on the grounds that the 2025 and disapproved-2016 rules were not “substantially the same” Judge Griffin disagreed on both the “unjust or unreasonable” practices authority and the CRA.
Today–nearly a full year later, the Sixth Circuit granted rehearing en banc and vacated the panel’s decision — an ominous sign for those who think it is good for regulators to be able to regulate to protect consumers.
